Adversarial Robustness. Adversarial Training (AT) [1]}, which trains a classifier using PGD-generated adversaries, is the most popular and studied adversarial defense. Many variations and improvements have been introduced, including optimizing the training loop by recycling gradients of past adversaries [2]}, combining single step FGSM with random initialization to achieve similar robustness [3]}, learning with auxiliary unlabeled data [4]}, local linearization [5]}, and the use of smooth activation functions [6]}. An alternative approach to adversarial training involves the use of preprocessing transformations. Randomized smoothing [7]} and related methods [8]} add noise to the input signal to remove adversarial signals. Many other preprocessing defenses have been proposed [9]}, [10]}, [11]}, but nearly all of these methods can be broken by adaptive attacks that are aware of the preprocessing method [12]}. A notable exception is the EBM defense [13]}, which uses midrun MCMC trajectories to purify images. We ease the restriction of learning EBMs with stability for arbitrary MCMC runs in the EBM defense by introducing a midrun sampler that enables faster learning of defensive EBMs and allows the EBM defense to scale to more complex datasets.
